@echo off

rem  Print a quick help message if nothing is passed to this script
if "%~1"=="" (
set SCRIPT=%~0
echo Create local administrator user account
echo.
echo Usage:
echo %SCRIPT% -u [username] -p [password] -n [display name]
echo.
echo Example:
echo %SCRIPT% -u myadmin -p p@ssw0rd -n "My Admin"
goto end
)

rem Get the params passed in on the command line
:parse
if "%~1"=="" goto endparse
if "%~1"=="-u" set USER=%2
if "%~1"=="-p" set PASS=%2
if "%~1"=="-n" set NAME=%2
shift
shift
goto parse
:endparse

rem Make sure we don't run this on a domain controller
wmic os get producttype | find "2" 1>nul 2>nul && goto domain-controller

rem  Make sure the specified user doesn't already exist
net user | find /i "%USER%" >nul || goto create-admin
goto reset-password

rem  Create a new user with the specified name and password
:create-admin
net user %USER% %PASS% /add /fullname:"%NAME%" /active:yes /expires:never /passwordreq:yes /times:all
goto make-admin

rem  If the specified user already exists, reset it's password
:reset-password
net user %USER% %PASS% /fullname:"%NAME%" /active:yes /expires:never /passwordreq:yes /times:all

rem  Add the specified user to the local Administrators group if it isn't already a member
rem  Note: if you're using Restricted Groups in an Active Directory GPO, this change may be overwritten at the next policy application
net localgroup Administrators | find /i "%USER%" >nul || goto make-admin
goto remove-logon
:make-admin
net localgroup Administrators %USER% /add

rem  Remove user from logon screen
:remove-logon
if exist "%ProgramFiles(x86)%" (
	reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "%USER%" /t REG_DWORD /d 0 /f /reg:64 >nul
	goto finish-remove-logon
)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "%USER%" /t REG_DWORD /d 0 /f >nul
:finish-remove-logon
goto end

:domain-controller
rem  This computer is a domain controller. The local %USER% account cannot be created.

:end